Forgotten Test Server Left Live Customer Data Exposed for Months

A security audit conducted ahead of a cloud migration project uncovered a serious oversight: a test environment that was accessible from outside the company network and connected to a database containing real, live customer data. According to Richard Schut, Managing Director and AI Software Researcher at SmartRepl, who led the audit at a previous employer, the environment was originally spun up quickly so a development team could demonstrate an application and test a migration process.

The problem was that this 'temporary' setup was never decommissioned. Months after it was created, the staging server was still running, and because it was never meant to be permanent, it lacked the authentication and access controls used in the company's actual production systems. Adding to the concern, the database file was plainly named in a way that made its contents obvious to anyone who found it.

Once the issue was discovered, Schut and his team immediately restricted access to the staging environment and launched a broader review of the company's other development and test systems to check for similar exposures. The case highlights a common but underappreciated risk: security failures often stem not from sophisticated attacks, but from short-term fixes that are forgotten and left unmanaged.